Setting up a Pionex API key takes about five minutes. The "create api" flow in 2026 is: sign into your account, click your avatar to open Account Settings, navigate to API Management, click Create API, add a label, then verify with both an email code and your 2FA. That's the whole procedure.
The part that matters more is the API level you choose. Pionex offers three permission tiers: Read, Trade, and Withdraw. For any bot, copy-trading platform, or portfolio tracker, the correct configuration is Read plus Trade. Never Withdraw. A leaked API key with Withdraw access is an empty account, and there's no recovery path because Pionex API Documentation states plainly: "Never tell your API Key/Secret to anyone."
There's also a one-time window that trips up new users: as CoinLedger's Pionex import guide warns, "Copy and store your secret key somewhere safe, as you will not be able to recover it later." Close that window without saving and you're generating a new key from scratch.
This same principle (trade access, never withdrawal access) is the baseline for how AO Shadow connects to exchange accounts for position management and copy trading: execution access only, withdrawal settings never touched.
What Pionex API Permission Levels Actually Mean
The three Pionex permission levels (Read, Trade, Withdraw) are not equally safe, and the gap between Trade and Withdraw is the one that ends accounts. Understanding what each level actually does (not just what it's called) is the most important thing to get right before you touch the create API screen.
Read is what portfolio trackers and tax tools need. An external app with only Read access can pull your balance, open positions, and transaction history. Nothing it does can move money or place an order. The risk is informational only: a leaked Read key tells someone what you hold, not how to take it.
Trade is what execution bots and copy-trading integrations need. Combined with Read, a Trade-level key lets a bot open positions, adjust grid orders, manage DCA entries, and close trades. It cannot send funds anywhere. This is the standard permission pair for Pionex's built-in automation. DayTrading.com's 2026 Pionex review confirms: "Pionex offers 16+ free integrated trading bots requiring no coding knowledge."
Withdraw is where accounts disappear. This permission lets a connected application initiate a withdrawal to any whitelisted address. If a platform asks you to enable Withdraw access, that's a serious red flag. The only scenario where Withdraw makes sense is an internal tool you built yourself, running on a server you fully control.
One technical constraint worth knowing before you build anything: CoinLedger notes that "Pionex's API has built-in limitations which may prevent you from acquiring any transaction history older than 3 months." For tax or performance attribution covering a longer window, CSV exports fill the gap.
| Permission | What It Allows | Appropriate For | Risk If Leaked |
|---|---|---|---|
| Read | View balances, history, open positions | Portfolio trackers, tax tools | Low (view only) |
| Trade | Place, manage, and close orders | Bots, copy-trading platforms | Medium (no withdrawals) |
| Withdraw | Send funds out of account | Almost never third-party tools | Critical |
Step-by-Step: Creating Your Pionex API Key in 2026
The create API flow in 2026 runs as follows. Sign into Pionex. Click your account avatar in the top right and open Account Settings. Go to API Management. Click Create API, enter a label that tells you what this key is for (something like "Grid Bot" or "Portfolio Tracker"), then verify with an email code and your 2FA authenticator app.
When the key generates, stop. Copy both the API key and the secret key to a secure location before closing the screen. The secret displays once. There's no resend option, no "forgot my secret," no support ticket that recovers it. If you're holding positions and your bot stops working because you lost the key, you're re-keying from scratch while the market moves.
Before you close the setup screen, configure your IP whitelist. List only the server addresses that will actually call the API. A key with no IP whitelist can be called from anywhere the moment someone gets hold of it. A key with an IP whitelist is useless to anyone who doesn't control your server.
Set permissions to Read and Trade. Leave Withdraw unchecked.
Developers working programmatically have community options: pionex-py on PyPI provides a Python SDK wrapping the REST API. Traders bridging Pionex into MetaTrader execution stacks can find a community EA connector approach at MQL5, though this is community-maintained code rather than an official Pionex integration.
The full 2026 API surface covers Trade, Bot, Futures (invite-only), Earn (beta), and Partner (invite-only) endpoints, all documented at pionex.com/docs/api-docs. Standard fees: 0.05% maker and taker. Accounts above 300,000 USDT in 30-day volume drop to 0% maker fee, which matters for high-frequency grid strategies running through the API.
The Regulatory Variable Nobody Mentions
Most Pionex setup guides cover the technical steps cleanly and stop there. What they don't tell you is that in 2026, the most important variable governing whether your bot stays running isn't the API configuration. It's which legal entity your account sits with, and whether that entity is operating legally in your jurisdiction.
